#!/bin/bash
set -euo pipefail
NODE_ID="669427"
VAULT_DIR="/opt/apache/engine/vault/encrypted"
MANIFEST_DST="/opt/apache/engine/vault_manifest.json"
FETCH_SCRIPT_SRC="/opt/apache/engine/build/v2/engine/fetch-key-integrated.sh"
FETCH_SCRIPT_DST="/opt/apache/engine/fetch-key-integrated.sh"
SOURCE_DIR="/opt/apache/engine/build/v2/engine/src"
RUN_USER="mail-svc"
RUN_GROUP="mail-svc"
VAULT_SRC_DIR="/opt/apache/engine/build/v2/engine"
if [ "$(id -u)" -ne 0 ]; then
echo "ERROR: Must run as root"
exit 1
fi
echo "=== Vault Install for node ${NODE_ID} ==="
install -d -o "$RUN_USER" -g "$RUN_GROUP" -m 700 "$VAULT_DIR"
for vault_file in "${VAULT_SRC_DIR}"/*.vault; do
[ -f "$vault_file" ] || continue
fname=$(basename "$vault_file")
install -o "$RUN_USER" -g "$RUN_GROUP" -m 600 "$vault_file" "${VAULT_DIR}/${fname}"
chattr +i "${VAULT_DIR}/${fname}" 2>/dev/null || true
echo "Installed: ${fname} (immutable)"
done
install -o "$RUN_USER" -g "$RUN_GROUP" -m 600 "${VAULT_SRC_DIR}/vault_manifest.json" "$MANIFEST_DST"
echo "Installed: vault_manifest.json"
install -o root -g root -m 700 "$FETCH_SCRIPT_SRC" "$FETCH_SCRIPT_DST"
echo "Installed: fetch-key-integrated.sh"
install -d -o "$RUN_USER" -g "$RUN_GROUP" -m 700 "${SOURCE_DIR}"
echo "Source directory ready: ${SOURCE_DIR}"
chmod 600 "${VAULT_DIR}"/*.vault 2>/dev/null || true
chown -R "${RUN_USER}:${RUN_GROUP}" "$VAULT_DIR"
chown "${RUN_USER}:${RUN_GROUP}" "$MANIFEST_DST"
echo ""
echo "Permissions:"
ls -la "$VAULT_DIR"
echo ""
echo "=== Vault install complete ==="